SAP Fiori: My Spend, csrf-token error

[Former Member]

When testing the My Spend application we get the following error:

Is it possible this is an error within Fiori itself, that got solved by a SAP note? In that case, which SAP note?

When simulating the request with the use of a REST client, i was able to get a 202 Accepted (after adding a csrf token ofcourse).

Any ideas on how to fix this?

[gilbert_wong · Accepted solution]

Hi All,

I am having the same issue with the standard MySpend Application.  I have applied the latest SAPUI5 to 1.14.6 and still get the same error.  Not sure what is causing this issue.  My other Fiori apps work fine.  Just the MySpend application.         

Thanks,

GW

EDIT:  I finally got it working.  After applying the latest SAPUI5 1.14.6, I had to invalidate the ITS cache using transaction SITSPMON.  Once I did that, it finally worked and I got pass the CSRF token validation error.

I believe the fix is in 1.14.3, but I went ahead and applied the latest SAPUI5.

[Former Member · Accepted solution]

Thnx man, this cleared my error too.

Cheers!

[swethapadma_oleti · Accepted solution]

Hi Nico,

I am also facing this issue. I was happy to see that there is a solution for this.

Can you please tell me how to apply the latest SAPUI5 1.14.6 ?

and how to I invalidate the ITS cache?

Thanks,

Swetha

[jcgood25 · Accepted solution]

Check out:

Regards,

Jeremy

SAP Rapid Innovation Group - RIG

[Former Member · Accepted solution]

Hey Swetha

The link Jeremy provided is correct.

You should be fine when completing those steps.

Kind Regards,

Nico

[Vlad]

Hello Nico,

I have found the same error, and currently investigating it. If I have any progress on the issue, I will let you know.

Kind regards,

Vlad

[jamie_cawley]

I would recommend updating the UI5 version to the latest, there has been some fixes regarding batch token handling since SP00.  I can confirm that this issue does not exist in SP05.

Regards,

Jamie

SAP - Rapid Innovation Group

[Vlad]

Hello Jamie,

The SAP_UI component has the version 740, SP04. Which NetWeaver ABAP version are you using?

Kind regards,

Vlad

[jamie_cawley]

I'm referring to the UISAPUI5 component, which I have tested this against SP05.

Regards,

Jamie

SAP - Rapid Innovation Group

[Former Member]

I'm gonna try to update to UI5 SP05, hopefully it will solve the problem.

I'll let you guys know, but it might take a while since I'm not the one to decide about updates.

EDIT: It didn't help. SAPUI5 is at version 1.14.2 now, but the token error remains.

Thnx for your help so far!

[Vlad]

Hello Nico,

There is another note which includes the CSRF token for batch requests fix:

0001914663 - SAPUI5 update to version 1.14.3

Can you please check it?

• [FIX] ODataModel: fix token handling when using BATCH

Kind regards,

Vlad

[Former Member]

Hi Nico,

Could you please describe what kind of HTTP request are you trying to perform.

Also in the meantime , you could try the following steps:

1. Try making a request directly to the backend gateway by fetching the csrf-token via GET request.

2.Clear the browser cookies and try to make a request .

Hope this information helps.

Regards,

Latha

[Former Member]

The request is a $batch POST operation.

The thing is, it is one of the standard applications that come with SAP Fiori, and not a custom app.

That's why I'm clueless on how to solve this.

If it were my own code, I could indeed add a GET to fetch the csrf-token.

[jamie_cawley]

What version/build of My Spend and SAPUI5 are you using?  Click the gear, About SAP Fiori for the information.  Does this happen as soon as you open the app or is there a process to this, please explain? 

Regards,

Jamie

SAP - Rapid Innovation Group

[Former Member]

Version 1.2.0 of My Spend and SAPUI5 1.14.0

As soon as the application loads, the popup shows.

When I check the load with F12 in chrome I can see there is another call the the same service. But just a GET for all collections ([Users, SpendingDataCollection, HierarchyNodes, Notes, GeneralParameters]), which does work. And it also gets back a csrf token.

What I do notice, is that it gets called AFTER the $batch call which has the csrf token error ...